CVE-2016-6316
actionview Cross-site Scripting vulnerability
CVE-2016-6316 is a medium vulnerability (CVSS 6.1) in Rubyonrails Rails, published August 25, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.44%, the 88th percentile. Fixed in actionview 3.2.22.3.
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.
- Record
CVE-2016-6316- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.
- Record
CVE-2016-6316- Updated
- 2026-11-02
EUVDEUVD-2017-0281 No score
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.
- Record
EUVD-2017-0281- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pc3m-v286-2jwj
actionview Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.
- Record
GHSA-pc3m-v286-2jwj- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.
- Record
CVE-2016-6316- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-6316
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.
- Record
DEBIAN-CVE-2016-6316- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-pc3m-v286-2jwj
actionview Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.
- Record
GHSA-pc3m-v286-2jwj- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVRHSA-2016:1855
Red Hat Security Advisory: rh-ror42 security update
- Record
RHSA-2016:1855- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2016:1856
Red Hat Security Advisory: rh-ror41-rubygem-actionview security update
- Record
RHSA-2016:1856- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2016:1857
Red Hat Security Advisory: ror40-rubygem-actionpack security update
- Record
RHSA-2016:1857- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2016:1858
Red Hat Security Advisory: ruby193-rubygem-actionpack security update
- Record
RHSA-2016:1858- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVSUSE-SU-2017:2716-1 No score
Security update for the Ruby on Rails stack
This update brings version 4.2.9 of the Ruby on Rails stack to provide the latest fixes and improvements from upstream.
The following security issues have been fixed by upstream:
rubygem-actionpack-4_2
- CVE-2016-2098: Action Pack in Ruby on Rails allowed remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method (bsc#968849).
rubygem-activerecord-4_2
- CVE-2016-6317: Action Record did not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allowed remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request (bsc#993313).
rubygem-actionview-4_2
- CVE-2016-6316: Cross-site scripting (XSS) vulnerability in Action View might have allowed remote attackers to inject arbitrary web script or HTML via text declared as 'HTML safe' and used as attribute values in tag handlers (bsc#993302).
Additionally, the following packages have been updated to version 4.2.9:
- rubygem-rails-4_2
- rubygem-railties-4_2
- rubygem-activesupport-4_2
- rubygem-activerecord-4_2
- rubygem-activejob-4_2
- rubygem-actionview-4_2
- rubygem-actionpack-4_2
- rubygem-actionmailer-4_2
- Record
SUSE-SU-2017:2716-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
actionviewRubyGems |
3.0.0 to 3.2.22.2 | 3.2.22.3 |
actionviewRubyGems |
4.0.0 to 4.2.7 | 4.2.7.1 |
actionviewRubyGems |
5.0.0 to 5.0.0 | 5.0.0.1 |
railsDebian:12 |
before 2:4.2.7.1-1 | 2:4.2.7.1-1 |
railsDebian:13 |
before 2:4.2.7.1-1 | 2:4.2.7.1-1 |
railsDebian:14 |
before 2:4.2.7.1-1 | 2:4.2.7.1-1 |
ruby-actionpack-3.2Debian:7 |
before 3.2.6-6+deb7u3, plus listed versions 3.2.6-63.2.6-6+deb7u13.2.6-6+deb7u2 |
3.2.6-6+deb7u3 |
railsDebian:8 |
before 2:4.1.8-1+deb8u4, plus listed versions 2:4.1.8-12:4.1.8-1+deb8u12:4.1.8-1+deb8u22:4.1.8-1+deb8u3 |
2:4.1.8-1+deb8u4 |
actionviewRubyGems |
3.0.0 up to 3.2.22.3 | 3.2.22.3 |
actionviewRubyGems |
4.0.0 up to 4.2.7.1, plus listed versions 4.1.04.1.0.beta14.1.0.beta24.1.0.rc14.1.0.rc2 Show 45 moreShow less4.1.14.1.104.1.10.rc14.1.10.rc24.1.10.rc34.1.10.rc44.1.114.1.124.1.12.rc14.1.134.1.13.rc14.1.144.1.14.14.1.14.24.1.14.rc14.1.14.rc24.1.154.1.15.rc14.1.164.1.16.rc14.1.24.1.2.rc14.1.2.rc24.1.2.rc34.1.34.1.44.1.54.1.64.1.6.rc14.1.6.rc24.1.74.1.7.14.1.84.1.94.1.9.rc14.2.04.2.0.beta14.2.0.beta24.2.0.beta34.2.0.beta44.2.0.rc14.2.0.rc24.2.0.rc34.2.14.2.1.rc1 |
4.2.7.1 |
Show 59 moreShow less
| Package | Affected | Fixed |
|---|---|---|
actionviewRubyGems |
5.0.0 up to 5.0.0.1 | 5.0.0.1 |
rh-ror42-rubygem-actionpackRed Hat:rhel_software_collections:2::el7 |
before 1:4.2.6-3.el7 | 1:4.2.6-3.el7 |
rh-ror42-rubygem-actionpack-docRed Hat:rhel_software_collections:2::el7 |
before 1:4.2.6-3.el7 | 1:4.2.6-3.el7 |
rh-ror42-rubygem-actionviewRed Hat:rhel_software_collections:2::el7 |
before 0:4.2.6-3.el7 | 0:4.2.6-3.el7 |
rh-ror42-rubygem-actionview-docRed Hat:rhel_software_collections:2::el7 |
before 0:4.2.6-3.el7 | 0:4.2.6-3.el7 |
rh-ror42-rubygem-activerecordRed Hat:rhel_software_collections:2::el7 |
before 1:4.2.6-3.el7 | 1:4.2.6-3.el7 |
rh-ror42-rubygem-activerecord-docRed Hat:rhel_software_collections:2::el7 |
before 1:4.2.6-3.el7 | 1:4.2.6-3.el7 |
rh-ror41-rubygem-actionviewRed Hat:rhel_software_collections:2::el6 |
before 0:4.1.5-6.el6 | 0:4.1.5-6.el6 |
rh-ror41-rubygem-actionview-docRed Hat:rhel_software_collections:2::el6 |
before 0:4.1.5-6.el6 | 0:4.1.5-6.el6 |
rh-ror41-rubygem-actionviewRed Hat:rhel_software_collections:2::el7 |
before 0:4.1.5-6.el7 | 0:4.1.5-6.el7 |
rh-ror41-rubygem-actionview-docRed Hat:rhel_software_collections:2::el7 |
before 0:4.1.5-6.el7 | 0:4.1.5-6.el7 |
ror40-rubygem-actionpackRed Hat:rhel_software_collections:2::el6 |
before 1:4.0.2-8.el6 | 1:4.0.2-8.el6 |
ror40-rubygem-actionpack-docRed Hat:rhel_software_collections:2::el6 |
before 1:4.0.2-8.el6 | 1:4.0.2-8.el6 |
ror40-rubygem-actionpackRed Hat:rhel_software_collections:2::el7 |
before 1:4.0.2-8.el7 | 1:4.0.2-8.el7 |
ror40-rubygem-actionpack-docRed Hat:rhel_software_collections:2::el7 |
before 1:4.0.2-8.el7 | 1:4.0.2-8.el7 |
ruby193-rubygem-actionpackRed Hat:rhel_software_collections:2::el6 |
before 1:3.2.8-20.el6 | 1:3.2.8-20.el6 |
ruby193-rubygem-actionpack-docRed Hat:rhel_software_collections:2::el6 |
before 1:3.2.8-20.el6 | 1:3.2.8-20.el6 |
ruby193-rubygem-actionpackRed Hat:rhel_software_collections:2::el7 |
before 1:3.2.8-20.el7 | 1:3.2.8-20.el7 |
ruby193-rubygem-actionpack-docRed Hat:rhel_software_collections:2::el7 |
before 1:3.2.8-20.el7 | 1:3.2.8-20.el7 |
rubygem-actionmailer-4_2SUSE:OpenStack Cloud 6 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
rubygem-actionpack-4_2SUSE:OpenStack Cloud 6 |
before 4.2.9-7.3.1 | 4.2.9-7.3.1 |
rubygem-actionview-4_2SUSE:OpenStack Cloud 6 |
before 4.2.9-9.3.1 | 4.2.9-9.3.1 |
rubygem-activejob-4_2SUSE:OpenStack Cloud 6 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
rubygem-activemodel-4_2SUSE:OpenStack Cloud 6 |
before 4.2.9-6.3.1 | 4.2.9-6.3.1 |
rubygem-activerecord-4_2SUSE:OpenStack Cloud 6 |
before 4.2.9-6.3.1 | 4.2.9-6.3.1 |
rubygem-activesupport-4_2SUSE:OpenStack Cloud 6 |
before 4.2.9-7.3.1 | 4.2.9-7.3.1 |
rubygem-rails-4_2SUSE:OpenStack Cloud 6 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
rubygem-rails-html-sanitizerSUSE:OpenStack Cloud 6 |
before 1.0.3-8.3.1 | 1.0.3-8.3.1 |
rubygem-railties-4_2SUSE:OpenStack Cloud 6 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
rubygem-actionmailer-4_2SUSE:OpenStack Cloud 7 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
rubygem-actionpack-4_2SUSE:OpenStack Cloud 7 |
before 4.2.9-7.3.1 | 4.2.9-7.3.1 |
rubygem-actionview-4_2SUSE:OpenStack Cloud 7 |
before 4.2.9-9.3.1 | 4.2.9-9.3.1 |
rubygem-activejob-4_2SUSE:OpenStack Cloud 7 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
rubygem-activemodel-4_2SUSE:OpenStack Cloud 7 |
before 4.2.9-6.3.1 | 4.2.9-6.3.1 |
rubygem-activerecord-4_2SUSE:OpenStack Cloud 7 |
before 4.2.9-6.3.1 | 4.2.9-6.3.1 |
rubygem-activesupport-4_2SUSE:OpenStack Cloud 7 |
before 4.2.9-7.3.1 | 4.2.9-7.3.1 |
rubygem-rails-4_2SUSE:OpenStack Cloud 7 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
rubygem-rails-html-sanitizerSUSE:OpenStack Cloud 7 |
before 1.0.3-8.3.1 | 1.0.3-8.3.1 |
rubygem-railties-4_2SUSE:OpenStack Cloud 7 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
rubygem-actionmailer-4_2SUSE:Enterprise Storage 3 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
rubygem-actionpack-4_2SUSE:Enterprise Storage 3 |
before 4.2.9-7.3.1 | 4.2.9-7.3.1 |
rubygem-actionview-4_2SUSE:Enterprise Storage 3 |
before 4.2.9-9.3.1 | 4.2.9-9.3.1 |
rubygem-activejob-4_2SUSE:Enterprise Storage 3 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
rubygem-activemodel-4_2SUSE:Enterprise Storage 3 |
before 4.2.9-6.3.1 | 4.2.9-6.3.1 |
rubygem-activerecord-4_2SUSE:Enterprise Storage 3 |
before 4.2.9-6.3.1 | 4.2.9-6.3.1 |
rubygem-activesupport-4_2SUSE:Enterprise Storage 3 |
before 4.2.9-7.3.1 | 4.2.9-7.3.1 |
rubygem-rails-4_2SUSE:Enterprise Storage 3 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
rubygem-rails-html-sanitizerSUSE:Enterprise Storage 3 |
before 1.0.3-8.3.1 | 1.0.3-8.3.1 |
rubygem-railties-4_2SUSE:Enterprise Storage 3 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
rubygem-actionmailer-4_2SUSE:Enterprise Storage 4 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
rubygem-actionpack-4_2SUSE:Enterprise Storage 4 |
before 4.2.9-7.3.1 | 4.2.9-7.3.1 |
rubygem-actionview-4_2SUSE:Enterprise Storage 4 |
before 4.2.9-9.3.1 | 4.2.9-9.3.1 |
rubygem-activejob-4_2SUSE:Enterprise Storage 4 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
rubygem-activemodel-4_2SUSE:Enterprise Storage 4 |
before 4.2.9-6.3.1 | 4.2.9-6.3.1 |
rubygem-activerecord-4_2SUSE:Enterprise Storage 4 |
before 4.2.9-6.3.1 | 4.2.9-6.3.1 |
rubygem-activesupport-4_2SUSE:Enterprise Storage 4 |
before 4.2.9-7.3.1 | 4.2.9-7.3.1 |
rubygem-rails-4_2SUSE:Enterprise Storage 4 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
rubygem-rails-html-sanitizerSUSE:Enterprise Storage 4 |
before 1.0.3-8.3.1 | 1.0.3-8.3.1 |
rubygem-railties-4_2SUSE:Enterprise Storage 4 |
before 4.2.9-3.3.1 | 4.2.9-3.3.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
rhn.redhat.com/errata/RHSA-2016-1856.html
puppet.com/security/cve/cve-2016-6316
securityfocus.com/bid/92430
openwall.com/lists/oss-security/2016/08/11/3
Show 34 moreShow less
weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released
groups.google.com/forum
debian.org/security/2016/dsa-3651
nvd.nist.gov/vuln/detail/CVE-2016-6316
web.archive.org/web/20200227202008/http://www.securityfocus.com/bid/92430
github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-6316.yml
security-tracker.debian.org/tracker/CVE-2016-6316
access.redhat.com/errata/RHSA-2016:1855
bugzilla.redhat.com/show_bug.cgi?id=1365008
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1855.json
cve.org/CVERecord?id=CVE-2016-6316
suse.com/support/update/announcement/2017/suse-su-20172716-1
bugzilla.suse.com/1055962
Left out here: 17 versions. The JSON record has them.